Mobile Device Connection

Settle the definition first: phones and tablets, not laptops.

The guide defines a mobile device by small form factor, wireless operation, on-board storage, and a self-contained power source, and its examples are smart phones, e-readers, and tablets. Laptops are mobile computing platforms, addressed by AC.L2-3.1.19. An assessor may still ask about laptops here. Answer from the definition, and show laptops handled under the requirements that do govern them.

The three objectives are a list, a gate, and a log.

CUI is the controlled unclassified information your contract requires you to protect. Identify which mobile devices process, store, or transmit CUI [a], authorize connections before they happen [b], and monitor and log them [c]. A mobile device management or mobile application management platform delivers all three at once: enrollment is the identification and the authorization gate, and the console provides the monitoring and logging. Assign each device an identifier so the log entries tie back to the inventory.

Application-level management works for bring-your-own-device.

App protection policies through Intune contain CUI inside managed applications on personal phones. The container is policy-controlled, connections are authorized per app, and the platform logs them. Run the pattern from the tenant that matches your data. It satisfies the objectives from a GCC or GCC High tenant, and the personal device around the container stays out of the CUI boundary.

Prohibition is a valid answer written as met, not as not applicable.

Blocking mobile devices entirely satisfies the requirement when conditional access, the sign-in rules in your tenant, actually enforces the block. Describe the enforcement in the system security plan. A not-applicable claim asserts the situation cannot arise, which is not true of a policy that a phone can violate.

A phone that holds CUI is a CUI asset.

Management software does not demote it to a lesser asset category. If the device itself stores or processes CUI, it carries a CUI asset's obligations, which is the argument for containing CUI inside managed apps or keeping it off phones entirely.